R2v3 Certification: What ITAD Auditors Check and Why It Comes Down to the Serial Number

Key takeaways

• R2v3 is the current version of the R2 Standard for electronics reuse and recycling, run by SERI (Sustainable Electronics Recycling International).
• It has 10 core requirements that apply to every certified facility, plus appendices that apply based on what the facility does.
• Any facility that erases data with software must also be certified to Appendix B, Data Sanitization.
• Auditors check whether any device can be traced, by serial number, from intake to final disposition.
• Most chain-of-custody gaps start at intake, when serials are typed by hand or not captured at all.

What Is R2v3 Certification?

R2v3 certification shows that an electronics reuse, repair or recycling facility meets the R2 Standard, version 3, for environmental, health, safety and data security practices. The standard is owned by SERI and facilities are audited by accredited third-party certification bodies.

For ITAD (IT asset disposition) companies, R2v3 has become a baseline customers ask for. Enterprise buyers, especially in regulated sectors, often require it before they hand over retired laptops, servers and phones.

The 10 R2v3 Core Requirements

Every R2v3 facility must meet all 10 core requirements. Appendices are added on top, depending on the services the facility offers.

The appendices cover specific activities. They include Appendix A (Downstream Recycling Chain), Appendix B (Data Sanitization), Appendix C (Test and Repair) and Appendix D (Specialty Electronics Reuse), among others.

Core 7 vs Appendix B: Which Applies to You?

Core 7 applies to every R2v3 facility. Appendix B applies if your facility performs logical sanitization erasing data with software so the device can be reused.

• Physical destruction only (shredding, crushing, disintegrating) using a NIST SP 800-88 method: Core 7 can cover it, and Appendix B is not required.
• Software erasure for reuse or resale: Appendix B certification is required.

Most ITAD operators that refurbish and resell devices therefore need Appendix B. That brings stricter requirements for sanitization records — which is where serial numbers become critical.

What R2v3 Auditors Check

Auditors want proof, not policy. The core test is simple: pick any device, and show its full history.

In practice, that means an auditor can choose a serial number from a customer manifest, a sanitization log or a sales record, and expect you to show:

1. When and from whom it was received.
2. Where it was stored and who handled it.
3. How its data was sanitized, with what method, and whether it was verified.
4. Its test and grade result, if it was refurbished.
5. Where it went: resale, a downstream recycler, or destruction.

If the serial on the intake record doesn’t match the serial on the erasure certificate, the trail breaks. One mismatch can turn into a finding.

What a Data Destruction Certificate Should Include

A data destruction certificate is the record that proves a specific device’s data was sanitized. SERI’s recommended record fields are modeled on NIST SP 800-88, the U.S. guideline for media sanitization. NIST published Revision 2 of SP 800-88 in September 2025.

A strong certificate, issued per device, records:

Batch certificates that say “200 laptops destroyed” without a serial for each are a common audit gap.

Where Chain of Custody Breaks

Most erasure and destruction tools record serials automatically once the device is on the bench. The weak point is earlier: intake and receiving.

• Typed serials. Technicians key in 10–20 character serials from small, faded labels. Look-alike characters (0/O, 1/I, 8/B) cause mismatches later.
• Devices that won’t boot. Dead or locked devices can’t report their own serial, so it must be read off the label.
• Loose drives. Drives pulled from devices need their own serials captured and linked to the parent asset.
• Spreadsheet manifests. Manifests that list counts instead of serials can’t be reconciled line by line.

Every one of these happens before sanitization software ever touches the device. If intake is wrong, every later record inherits the error.

How Serial-Level Capture Keeps You Audit-Ready

The fix is to capture the serial correctly at the first touchpoint, from the label, and use that same record at every step after.

Scanflow ITAD serial number scanning is part of Scanflow Capture, an AI-enabled SDK for iOS and Android. It lets ITAD teams scan serial numbers, model numbers and barcodes from device and drive labels with a phone or tablet, inside the apps they already use.

For an ITAD operator, that means:

• Intake by scan, not by typing – including devices that won’t power on.
• Multi-field labels in one capture – serial, model and barcode together, using serial number scanner and label capture.
• Drives linked to their parent device at the moment they are pulled.
• One clean serial that intake, erasure, grading and dispatch records can all match.

Scanflow does not certify facilities or replace erasure software. It makes the first record in the chain correct, so the rest of the chain can be proven.